Terms

Alibaba Cloud provides resource directories for enterprises to manage the relationship of a number of accounts.

A resource directory allows you to quickly establish an organizational structure based on your business requirements. Then, you can consolidate the accounts of your enterprise into this structure to form a hierarchy for resources. This way, you can manage accounts and resources in a centralized manner. The resource directory can meet your management requirements for network deployment, settlement, user permissions, security compliance, and log auditing.

A master account is the account that is used to enable a resource directory and is the super administrator of the resource directory. The master account has all administrative permissions on the resource directory and the member accounts in the resource directory. Only an Alibaba Cloud account that has passed enterprise real-name verification can be used as a master account. Each resource directory has only one master account.

To ensure the security of the master account, we recommend that you create an Alibaba Cloud account and use this account as the master account.

A member account serves as a container for resources and is also an organizational unit in a resource directory. A member account indicates a project or application. The resources of different member accounts are isolated.

The following types of member accounts are supported:

• Resource account

  We recommend that you use resource accounts in a resource directory. By default, root permissions are not granted to resource accounts. Therefore, resource accounts are secure. You can use a master account to authorize RAM users, user groups, or roles to access the resources of resource accounts.

• Cloud account

  A cloud account has all the features of an Alibaba Cloud account, including root permissions. When you create a cloud account in a resource directory, you must use a new email address as the logon name of the cloud account. For more information, see Create a member account. You can use a master account to authorize RAM users, user groups, or roles to access the resources of cloud accounts.

  Note

  If you want to use a created cloud account to log on to Alibaba Cloud, you must first reset the account password.

An Alibaba Cloud account serves as a unique ID for you to access, purchase, and manage resources on Alibaba Cloud. The account is also a resource container and a capital account. It identifies a user and represents an identity.

However, the member accounts are Alibaba Cloud accounts that serve only as resource containers. After you consolidate the accounts of your enterprise into a resource directory, you can also manage the users and funds that belong to these accounts in a centralized manner.

A tag consists of a key-value pair. Limits:

• A tag key must be 1 to 128 characters in length and cannot contain http:// or https://. It cannot start with acs: or aliyun.
• A tag value must be 1 to 128 characters in length and cannot contain http:// or https://. It cannot start with acs: or aliyun.
• Each tag key of a resource can have only one tag value. If you create a tag that has the same key as an existing tag, the value of the existing tag is overwritten.

  For example, the city:shanghai tag is added to a resource. If you add the city:newyork tag to the resource, the city:shanghai tag is automatically removed from the resource.